In the environment of course. It is a step better than just keeping all the secrets there, because an env leak won't leak the encrypted values, so you'll have a key with no door, so to speak.